ITADN
npm/cli/Issues

[BUG] approve-scripts cannot approve packages with dots in package name (ENOMATCH / silent no-op)

#9536Openrowiththeflow 创建于 2026-06-10
BugNeeds Triage
R
rowiththeflowcommented
### Is there an existing issue for this? - [x] I have searched the existing issues ### This issue exists in the latest npm version - [x] I am using the latest npm ### This is not just a request to bump a dependency for a CVE - [x] This is not solely a request to bump a dependency for a CVE ### Current Behavior npm approve-scripts cannot approve packages whose name contains dots (e.g. cordova.plugins.diagnostic). The package is correctly detected by npm approve-scripts --allow-scripts-pending as having unreviewed install scripts, but every approval path silently fails or errors — leaving the package permanently stuck as "pending" with no CLI path to approve it. - npm approve-scripts cordova.plugins.diagnostic → Nothing to approve; allowScripts unchanged - npm approve-scripts cordova.plugins.diagnostic@7.3.0 → ENOMATCH: No installed packages match - npm approve-scripts --all → silently skips it, Nothing to approve; allowScripts unchanged The workaround is to manually edit package.json: "allowScripts": { "cordova.plugins.diagnostic@7.3.0": true } ### Expected Behavior npm approve-scripts cordova.plugins.diagnostic should add "cordova.plugins.diagnostic@7.3.0": true to the allowScripts block in package.json, the same way it works for packages without dots in their name (e.g. @sentry/cli). ### Steps To Reproduce 1. Create a project that depends on cordova.plugins.diagnostic mkdir repro && cd repro cat > package.json << 'EOF' { "name": "repro", "version": "1.0.0", "dependencies": { "cordova.plugins.diagnostic": "7.3.0" } } EOF 2. Install npm install 3. See it flagged as pending — works correctly npm approve-scripts --allow-scripts-pending > 1 package has install scripts not yet covered by allowScripts: > cordova.plugins.diagnostic@7.3.0 (postinstall: node ./scripts/apply-modules.js) 4. Try to approve - silent no-op npm approve-scripts cordova.plugins.diagnostic > Nothing to approve; allowScripts unchanged 5. Try with version specifier - ENOMATCH npm approve-scripts cordova.plugins.diagnostic@7.3.0 > npm error code ENOMATCH > npm error No installed packages match: cordova.plugins.diagnostic@7.3.0 6. --all also silently skips it npm approve-scripts --all > Nothing to approve; allowScripts unchanged ### Environment - npm: 11.16.0 - Node.js: v22.22.3 - OS Name: macOS 15.7.5 - System Model Name: MacBook Pro - npm config: ; "user" config from /Users/<user>/.npmrc ; (auth tokens redacted) ; node version = v22.22.3 ; npm version = 11.16.0 ; Run `npm config ls -l` to show all defaults
0 条评论